从 github 部署到 Azure Web 应用程序失败，并显示 - 在目录中找不到标识符为“***”的应用程序

Question

我正在尝试从 github 部署到 azure web 应用程序。我有以下具有系统分配身份的网络应用程序：

我添加了一个秘密，其值如上图中所示的对象（主体）ID：

我在 github 中有以下 yaml 文件：

name: Build and deploy Python app to Azure Web App - fast-api-port

on:
  push:
    branches:
      - dev
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python version
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Create and start virtual environment
        run: |
          python -m venv venv
          source venv/bin/activate
      
      - name: Install dependencies
        run: pip install -r requirements.txt
        
      # Optional: Add step to run tests here (PyTest, Django test suites, etc.)

      - name: Zip artifact for deployment
        run: zip release.zip ./* -r

      - name: Upload artifact for deployment jobs
        uses: actions/upload-artifact@v4
        with:
          name: python-app
          path: |
            release.zip
            !venv/

  deploy:
    runs-on: ubuntu-latest
    needs: build
    environment:
      name: 'Production'
      url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
    permissions:
      id-token: write #This is required for requesting the JWT

    steps:
      - name: Download artifact from build job
        uses: actions/download-artifact@v4
        with:
          name: python-app

      - name: Unzip artifact for deployment
        run: unzip release.zip

      
      - name: Login to Azure
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_APP_DNA_PORT_API_DEV }}
          tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_6399B578ADAF41E095CA377A465B8BB1 }}
          subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_527AF2EA4A6A4A8BAC99ECB57B6CE6AB }}

      - name: 'Deploy to Azure Web App'
        uses: azure/webapps-deploy@v3
        id: deploy-to-webapp
        with:
          app-name: 'app-xx-xx-xx-dev'
          slot-name: 'Production'
      

我收到以下错误：

Attempting Azure CLI login by using OIDC...
Error: AADSTS700016: Application with identifier '***' was not found in the directory 'XXX'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant. Trace ID: xx-093c-48dd-a644-xxCorrelation ID: 13417bd2-xx-xx-xx-dbec55c0e135 Timestamp: 2025-01-07 11:17:48Z

它是网络应用程序的应用程序 ID 还是我遗漏了什么？

Answer 1

“系统分配的身份”通常是 Azure 为 Web 应用程序自动管理的身份。在这种情况下，应用程序 ID 是 Web 应用程序的托管标识本身，它不需要在 Azure AD 中注册单独的应用程序进行身份验证。

注意：如

MSDOC中所述，部署到具有用户分配的托管标识的Azure应用服务时，您需要传递对象（主体）ID。 我按照以下步骤使用 GitHub 操作使用系统分配的托管标识将 python 应用程序部署到 Azure 应用服务。

在 Web 应用程序中启用系统分配的托管身份：

使用

Deployment=>Deployment Center
• 下的 GitHub 操作配置部署，选择

  GitHub

  作为 Source，选择 Basic Authentication 作为 Authentication Type：

工作流程：

name: Build and deploy Python app to Azure Web App - App_Name
 
on:
  push:
    branches:
      - main
  workflow_dispatch:
 
jobs:
  build:
    runs-on: ubuntu-latest
 
    steps:
      - uses: actions/checkout@v4
 
      - name: Set up Python version
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
 
      - name: Create and start virtual environment
        run: |
          python -m venv venv
          source venv/bin/activate
      - name: Install dependencies
        run: pip install -r requirements.txt
 
      - name: Zip artifact for deployment
        run: zip release.zip ./* -r
 
      - name: Upload artifact for deployment jobs
        uses: actions/upload-artifact@v4
        with:
          name: python-app
          path: |
            release.zip
            !venv/
 
  deploy:
    runs-on: ubuntu-latest
    needs: build
    environment:
      name: 'Production'
      url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
    steps:
      - name: Download artifact from build job
        uses: actions/download-artifact@v4
        with:
          name: python-app
 
      - name: Unzip artifact for deployment
        run: unzip release.zip
 
      
      - name: 'Deploy to Azure Web App'
        uses: azure/webapps-deploy@v3
        id: deploy-to-webapp
        with:
          app-name: 'App_Name'
          slot-name: 'Production'
          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_312C7XX4B8BDC }}

GitHub 中的部署状态：